My AI drafted a polished cold email. It was also a lie, and I built the gate that stopped the send.

The email I almost admired

I remember the exact second I stopped trusting my own AI drafter. I had generated a cold email to a synthetic prospect I named Chris Tanaka, a VP of Engineering at a fictional FinTech company called Vaultline, in the voice of a rep I called Maya Chen. The draft was good. It opened on the prospect's live pain, it named the buying moment, it closed with a specific ask. If a real SDR had shown it to me in a pipeline review I would have said send it.

Then I read the second sentence again. "We are SOC 2 Type II certified and fully HIPAA certified." My product knowledge base, the one I had hand-seeded for this demo, held SOC 2 Type I. Not Type II. And it held no HIPAA certification at all. The email was fluent, on-brand, perfectly in Maya's voice, and false in a way that would end a deal the moment a security team pulled the actual attestation letter.

That is the thing nobody warns you about when you wire an LLM to your outreach. The failure is not a clumsy email. The failure is a convincing one. I had spent weeks assuming my problem was making the model write better. Standing there rereading a lie I would have sent, I understood the problem was the opposite. The model already wrote too well to be trusted without a check.

The failure mode of AI outreach is not a bad email. It is a good one that happens to be false.

I am Ashutosh, and I build at Veriprajna. This is the story of the thing I built after that email, and the assumption I had to kill to build it. You can run the whole thing yourself at veriprajna.com/demos/ai-sales-personalization.

The experiment that failed: asking the model to grade itself

My first instinct was the lazy one, and I want to be honest that I tried it. I thought: fine, if the model can write the email, the model can check the email. Give it the product facts, give it the draft, ask it to flag anything unsupported. Let the smart thing police the smart thing.

I ran that. It waved the Vaultline draft through more than once. Sometimes it caught the HIPAA claim and missed the SOC 2 one. Sometimes it "fixed" the certification by softening the wording while keeping the false claim. Worst of all, on the same input it did not always give me the same answer. A grader I cannot reproduce is not a grader, it is a mood. I could not hand a compliance partner a control that returns a different verdict depending on the weather inside the sampler.

That was the moment the real design clicked, and it clicked as a subtraction, not an addition. The checker could not live inside the model. It had to live outside it, in plain deterministic code that reads the same source of truth every time and returns the same verdict every time. The phrase I kept writing on the whiteboard became the whole product philosophy: agents advise, code decides.

So I split the system in two. An LLM is allowed to draft, because drafting in a specific human's voice is genuinely what it is good at. But nothing the model produces is allowed to reach a sending domain until a separate, boring, testable verifier crew has looked at it and a deterministic policy gate has said yes. The model proposes. The code disposes. And critically, the augmenting model verifier I later added can only add an unsupported finding. It can never clear a claim the deterministic check already flagged, and it cannot override the gate. I refused to build a system where a language model could talk its way past its own governance.

What does the gate check before an email can leave?

I designed the gate around the three things I had watched actually scare the buyers I talked to, not the things that make a nice slide. A VP of Sales who has already been burned by an autonomous AI SDR is not lying awake about prose quality. They are afraid of a false product claim, an EU AI Act Article 5 violation, and a torched sending domain. So the crew runs four independent checks on every draft: factual grounding against the source of truth, a deliverability score (computed in the demo, never actually sent), an EU AI Act Article 5 pass, and a style fidelity measurement. The policy gate then marks the email CLEAR only if there are no unsupported or contradicted claims, deliverability clears the 0.7 threshold, and Article 5 is clean. Anything else and it BLOCKS the send and routes the draft to a human with the exact reasons attached.

When I fed it the Vaultline draft, the gate did what I had failed to do by eye in the first hour. It fired red.

Two checks caught it, not one, and that mattered to me. The factual grounding check flagged the certifications. The Article 5 check flagged two other things I had let slip past me entirely: "Only 2 onboarding slots left this quarter" was manufactured scarcity, and "Most of your competitors have already moved" was deceptive social proof. I had been so fixated on the cert lie that I skated over the manipulation. The deterministic checks did not get tired the way I did on the second read.

I built the gate to catch what I miss on the second read, because there is always a second read where you stop paying attention.

The tone I kept fighting for in this stage was not "gotcha, the model lied." It was quieter than that. The point is that nothing false or manipulative reaches your domain in the first place. The block is not a punishment. It is a save.

Why keep a receipt for an email that never sent?

I did not want a gate that just says no. I have sat across from enough compliance people to know that "trust me, we blocked it" is worth nothing to them. What they can use is a document. So every run, cleared or blocked, seals a send-receipt: the model and provider and version, the timestamp, the provenance of which winning emails the voice was matched from, every claim with its verdict and citation, the deliverability sub-scores, the Article 5 result, and the final gate decision. JSON and rendered HTML, downloadable, filable.

Look at what that table says. It does not say "this email seems risky." It says SOC 2 Type II: CONTRADICTED, because source-of-truth holds SOC 2 Type I. It says HIPAA certified: UNSUPPORTED, no supporting certification in source-of-truth. Each verdict points at the exact document line it was checked against. That is the difference between a vibe and an audit trail, and it is the whole reason I think this layer survives the next model generation.

A gate that says no is a policy. A gate that says no and shows you the exact contradicted line is a control you can file.

Here is the argument I keep coming back to, and it is the one that convinced me this was worth building rather than waiting for GPT-N to fix it. Even a perfect model cannot know your current certifications or your live pricing. It cannot self-certify that it broke no EU rule. And it cannot hand your compliance team a filable trail. Those are properties of a system, not of a model. Provenance, a source-of-truth gate, a deliverability check, an audit receipt. Those do not get obsoleted by a smarter drafter. If anything a smarter, more persuasive drafter makes them more necessary, because the lies get more fluent.

The number that told me personalization was real, not asserted

I almost did not build the style store, and I want to admit why. Everyone in this space claims personalization. "Emails written for the persona, not about it." It is the most asserted and least measured claim in outbound. I was suspicious of my own version of it. A well-crafted prompt already produces a decent email. Was a whole style-retrieval layer actually earning its complexity, or was I decorating a prompt and calling it architecture?

So I built the honest test into the demo instead of hiding from it. A zero-shot baseline toggle. Same prospect, same product facts, but style injection turned off, and a stylometric fidelity score comparing the draft to the real rep's fingerprint. If the style store was theater, the number would barely move. I toggled it and watched.

The number moved, and the prose gave itself away. With style injection off, the draft slid straight into "delve into how Northwind Pay could transform its engineering landscape" and "unlock synergies and drive transformative outcomes." Those are the audible tells of a probabilistic mean. The style fidelity on that same prospect fell to 0.295 against Maya's fingerprint, where the style-injected version scored 0.5. Across the six-prospect held-out set, mean fidelity ran 0.483 with the style store on versus 0.275 zero-shot. A lift of +0.208, measured, on that specific set, in bundled-draft mode. Not a promise. A number I can regenerate.

Personalization is the most asserted and least measured claim in outbound. I wanted a number I could regenerate, not a sentence I could repeat.

The governance side of that panel is the one I trust the most. 5 out of 5 on the labeled adversarial set. The clean draft cleared. The SOC 2 Type II and ISO 27001 over-claim blocked. The "$5,000 build" that sits below the floor blocked as contradicted. The "only 2 slots, expires today" urgency blocked under Article 5. The "everyone has already switched, you will regret it" social proof blocked under Article 5. Five cases, five correct verdicts, and because the gate is deterministic it returns those same five verdicts every single time. An LLM judge cannot promise you that. I need to keep saying the honest part out loud: that 5 of 5 is accuracy on a five-case labeled set, not an open-world guarantee, and the fidelity numbers are the six-prospect set in bundled-draft mode. The discipline of attributing every number to its exact test is not a legal footnote. It is the same discipline the product is selling.

What I actually think this is about

I did not set out to build a governance product. I set out to make an AI write better sales email, and I ran head first into the fact that better writing was never the bottleneck. The market spent two years optimizing AI SDRs for volume and asserting personalization, and the public wreckage of that bet is not subtle. 11x.ai raised $74M and lost 70 to 80 percent of customers within months, claimed roughly $14M ARR against roughly $3M in real contracts, and ZoomInfo said the tool performed significantly worse than their own SDR employees, per TechCrunch in March 2025. Meanwhile Google began rejecting non-compliant bulk email in November 2025, Microsoft enforced in May 2025, and EU AI Act Article 5 has been enforceable since February 2025. The cost of a bad send in 2026 is not a bad email. It is a rejected domain and a regulator.

The lesson I keep turning over is that a better model would not have saved any of that. A better model writes a more persuasive false certification claim. It writes more fluent manufactured urgency. The thing that saves you is not smarter drafting, it is a decision that lives outside the drafter, reads a source of truth, and leaves a receipt. Personalization is not verification, and in 2026 neither one is enough on its own. You also need governance, sitting in the one place it has to sit: between the draft and the send. If you want to watch it block that email yourself, it is at veriprajna.com/demos/ai-sales-personalization.

And if you would rather watch it than read me describe it, here is the whole gateway running end to end, blocking that email and signing the receipt.

So here is the question I have started asking every RevOps leader who tells me their AI SDR is writing great email. Not whether the email is good. Can it prove which source backed the last claim it sent, and could it hand that proof to your compliance team this afternoon? If the answer is no, the writing was never the risk.